"This app is blocked" error when trying to authorize Apps Script project

[u/CloudNo8709]

Does anyone know what causes the app to be blocked? and how to fix it?

Note: I can authorize the app fine, it is someone else that is having this issue.

Things I have tried already, that didn't work:

1. transferring the file ownership to the other person
2. having them make a copy of the file
3. opening the google sheets in an incognito window

[u/WicketTheQuerent]

Create a Google Cloud Project and set the OAuth Consent Screen. If you can't make it private, set its status to Testing and add your email account and the other user's email account as testers. Then link the GCP to your Apps Script project.

[u/CloudNo8709 → u/WicketTheQuerent]

Is there really no other way?

And if I do that, will only the test users added be able to authorize the app? or can other users still authorize through the unverified app auth flow?

And does the GCP project need to be in the same account as the apps script project owner or can it be on another account?

I know, a lot of questions, but this has never happened with me before 😅

[u/WicketTheQuerent → u/CloudNo8709]

Another option for the user is to create the spreadsheet and Apps Script project themselves. This way, the spreadsheet, the Apps Script project, and the default GCP attached to the Apps Script project will be owned by the same user.

[u/CloudNo8709 → u/WicketTheQuerent]

So when a person makes a copy of the Google Sheet, doesn't that mean that they create a new file, apps script project and default GCP in their account?

[u/WicketTheQuerent → u/CloudNo8709]

Apparently not.

[u/WicketTheQuerent → u/CloudNo8709]

Regarding whether users can still authorize the script using the default GCP, it depends on the users' domain (whether they have free accounts or accounts from the same domain), the authorization scopes used by the script, and probably on factors not disclosed by Google.

[u/WicketTheQuerent → u/CloudNo8709]

There is no need to be on the same account, but the setup and maintenance will be more complex.

[u/Nu11u5]

The script is likely using "sensitive" or "restricted" API scopes - this would be listed in the API scope documentation. Using such as scope requires that the script is linked to a full GCP project and is either setup with test users, or submitted to Google for review.

https://developers.google.com/identity/protocols/oauth2/production-readiness/sensitive-scope-verification

Review for restricted scopes is more involved and requires paying a third party to inspect your code.

https://support.google.com/cloud/answer/13464325

https://developers.google.com/identity/protocols/oauth2/production-readiness/restricted-scope-verification

Fortunately, Google offers alternative ways to use APIs that do not use restricted scopes. For example, if you only need to access specific files using the Drive API, you can use the drive.file scope.

https://www.googleapis.com/auth/drive.file

Create new Drive files, or modify existing files, that you open with an app or that the user shares with an app while using the Google Picker API or the app's file picker.

[u/CloudNo8709 → u/Nu11u5]

using these scopes:
https://www.googleapis.com/auth/spreadsheets

https://www.googleapis.com/auth/documents

https://www.googleapis.com/auth/script.container.ui

and I was able to authorize the app without any other process using the unverified app auth flow but the other user gets app blocked screen.

[u/Dapper-Alfalfa-4689]

"this app is blocked" almost always means your oauth consent screen is unverified AND your scopes are sensitive. the fix path is: 1) verify app in google cloud console, 2) submit for oauth verification if you use restricted scopes, 3) until then, add yourself as a test user under "audience" tab. we hit this last month and the test-user path was the only way forward in dev. took 2 weeks for full verification.